Mixup can be interpreted as a method for convexifying class regions in the input space [1]}. By enforcing that convex combinations of training points are assigned convex combinations of the labels, this augmentation method regularizes class boundaries, and removes small non-convex regions. In particular, we are motivated by the idea of using mixup to promote the removal of small “gerrymandered” regions in input space in which a target/poisoned data instance is assigned an adversarial label while being surrounded by (non-poisoned) instances with different labels.
